STAY UP TO DATE: The Effects of the US Foreign Aid Freeze on Freedom House
Expanding Freedom and Democracy
Freedom on the Net 2024

Sri Lanka

Partly Free
53
100
A Obstacles to Access 14 25
B Limits on Content 21 35
C Violations of User Rights 18 40
Last Year's Score & Status
52 100 Partly Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the methodology and report acknowledgements.
Sri Lanka_hero_map

header1 Key Developments, June 1, 2023 - May 31, 2024

Several internet freedom issues in Sri Lanka remained of concern this year. Electricity blackouts appeared to be less severe compared to recent years. The government passed new restrictive legislation with the potential to curtail online free expression, including the Online Safety Act (OSA) and amendments to the Telecommunications Act. Journalists and online activists face arrests, threats, and harassment for their online activities. Despite these continued restrictions, Sri Lankans continued to engage in digital activism around a range of issues.

  • In May 2024, the government introduced amendments to the Telecommunications Act which grant the Telecommunications Regulatory Commission of Sri Lanka (TRCSL) expanded powers over licensing, tariffs, and determining public interest, which passed after the coverage period (see A4). The government passed the amended bill after the coverage period, in July, after adding clarifying language in response to a court petition opposing the amendments.
  • In May 2023, a cabinet-appointed subcommittee submitted a proposal to establish the Broadcasting Regulatory Commission (BRC) through a broadcasting regulatory act, and in November 2023 the cabinet approved the preparation of a draft bill (see B3).
  • In January 2024, the parliament passed the OSA, which criminalizes “false” and “harmful” online speech such as online harassment and abuse or content deemed to promote ill will and hostility (see B3 and C2). Civil society organizations (CSOs) said that the OSA’s overbroad provisions and vague definitions will grant authorities the power to restrict expression.

header2 Political Overview

Sri Lanka experienced improvements in political rights and civil liberties after the 2015 election of President Maithripala Sirisena, which ended the more repressive rule of Mahinda Rajapaksa. However, the Sirisena administration was slow to address the aftermath of a 26-year civil war between government forces and ethnic Tamil rebels, who were defeated in 2009. Gotabaya Rajapaksa’s election as president in November 2019 and the Sri Lanka Podujana Peramuna’s (SLPP) victory in the August 2020 parliamentary polls emboldened the Rajapaksa family. Gotabaya and Mahinda Rajapaksa resigned from their posts in the face of the Aragalaya (“Struggle”) protests—prompted by economic troubles, government mismanagement, and corruption—in 2022. While the government has since brought about relative stability, it has operated in ways that curtail civil liberties.

A Obstacles to Access

A1 1.00-6.00 pts0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 4.004 6.006

Score Change: The score increased from 3 to 4 because electricity blackouts appeared to be less severe compared to the previous coverage period.

Although internet access has increased in recent years, the speed and quality of service is inconsistent. The previous coverage period saw an increase in mobile broadband subscriptions and overall internet penetration, though some data suggest a decline in overall internet penetration during the current period. According to the TRCSL, there were over 19.9 million mobile broadband subscriptions and 2.5 million fixed-line broadband subscriptions as of March 2024.1 According to DataReportal’s Digital 2024 report, there were 12.3 million Sri Lankan internet users as of January 2024 and an overall internet penetration rate of 56.3 percent. DataReportal said there were 14.6 million internet users and a penetration rate of 66.7 percent in 2023.2

Unlike previous years, there were no daily rolling power outages during the coverage period.3 However, in October 2023, the Ceylon Electricity Board (CEB) disconnected electricity in over 544,000 homes due to the nonpayment of bills after tariffs were hiked that same month.4 In December 2023, the Kotmale-Biyagama transmission line broke down, which resulted in a five-and-a-half-hour long nationwide power outage, disrupting internet connectivity across the country.5 In May 2024, the CEB reported that over 467,500 consumers faced power outages across the country due to infrastructure damage from heavy rain.6 After the coverage period, in June 2024, the Ministry of Power and Energy preemptively disconnected power ahead of heavy rains to protect infrastructure in four districts, Galle, Kalutara, Colombo and Kegalle.7

In 2022, Airtel and Dialog Axiata announced they would shut down their 3G mobile networks by 2023 to support better 4G services.8 The government previously announced plans to implement 5G service but due to high implementation-related costs, that rollout has been delayed. 9 During the coverage period, service providers Sri Lanka Telecom (SLT)10 and Dialog Axiata11 conducted 5G trials.

Starlink, a satellite-based network system, is expected to expand service to Sri Lanka by 2025.12

A2 1.00-3.00 pts0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 1.001 3.003

Mobile internet connectivity is affordable, although gender-based and urban-rural digital divides persist. Prices for mobile broadband vary.1 Mobile users pay an average rate of 76 rupees ($0.23) for 1 gigabyte (GB) of data, according to UK-based Cable, though prices and the relative cost of mobile internet fluctuated during the country’s economic crisis.2 According to Cable’s 2024 study of global internet prices, the average monthly price for fixed-line broadband service was 7,620 rupees ($23.06), compared to a real mean household income of 76,414 rupees ($232) per the 2019 Household Income and Expenditure Survey.3

The government has imposed additional taxes on telecommunications services during the economic crisis. In December 2023, the parliament approved a value-added tax (VAT) increase from 15 to 18 percent, which was made effective on January 1, 2024.4 The VAT hike subsequently increased tariffs on mobile and fixed-line data services for Sri Lankan customers.5 During the previous coverage period, in September 2022, the TRCSL approved a 20 percent tariff hike for mobile and fixed-line services.6

Urban residents benefit from infrastructural advantages and are better connected to the internet. The province with the highest percentage of households accessing the internet is the Western Province, the country’s most populous,7 where Colombo and other urban areas boast well-developed infrastructure.

After the civil war, infrastructure development in the Northern and Eastern provinces was delayed, as funding for development was often directed to urban areas.8 However, the development of telecommunications infrastructure in these provinces has improved and led to increased internet usage. Nonetheless, compared to urban areas, rural and up-country Tamil communities have significantly lower computer and digital literacy rates.9

Government statistics for 2023 found that some 37.1 percent of the population in rural areas and 17.9 percent in estate areas were categorized as computer literate, compared to 52.9 percent in urban areas; the national rate stood at 39 percent.10

A3 1.00-6.00 pts0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 5.005 6.006

There was no blocking of social media and communications platforms during the coverage period.

In April 2022, the government blocked social media and communications platforms for about 16 hours as the 2022 Aragalaya protests intensified. The blocks—which covered social media platforms like Facebook, Twitter (now known as X), and YouTube and messaging apps like WhatsApp, Viber, and Telegram—were ordered by the Ministry of Defence, according to the TRCSL. Some Sri Lankans also reported difficulty accessing the internet during protests in March and April 2022, with some speculating that the government disrupted signals; the connectivity issues may have been related to congestion or infrastructural problems.1

Sri Lanka has access to multiple international cables, but most of the landing stations for these cables are controlled by SLT, giving the government control over internet infrastructure.2 SLT is a consortium member of the Singapore–France SEA-ME-WE submarine cable, and announced a $50 million investment for the cable’s installation in February 2023.3 The project hit a roadblock in February 2023 when Chinese mobile service providers China Telecom and China Mobile withdrew from the project due to tensions over infrastructure control, but is still on track to be completed by 2025.4

A submarine cable system between the Maldives and Sri Lanka, built by Huawei Marine Networks in partnership with Dialog Axiata, was ready for service in February 2021.5 In November 2022, the Indian conglomerate Reliance Industries received approval to build a submarine cable, the India-Asia-Xpress, from Singapore to Mumbai, though the cable would also connect to Sri Lanka. 6 India-Asia-Xpress is expected to become operable in 2024,7 after most recently landing in the Maldives in August 2023.8

A4 1.00-6.00 pts0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 3.003 6.006

Sri Lanka’s retail tariffs are relatively low, though the diversity of service providers is limited due to the dominance of some companies, particularly SLT.

There are three fixed-line providers in Sri Lanka: SLT, Lanka Bell, and Dialog Broadband Networks.1 SLT remains a key player, and the firm imposes price barriers by forcing competing service providers to lease connectivity from SLT, which charges high rates.2 As of 2022, the government owned a 49.5 percent stake in SLT and Global Telecommunications Holdings NV, a Dutch company, held a 45 percent stake.3 In March 2024, after months of speculation regarding Lanka Bell’s financial struggles, the Telecommunications Regulatory Commission of Sri Lanka released a consultation paper confirming that Lanka Bell would be shutting down its operations.4 However, as of June 2024, after the end of the coverage period, Lanka Bell had yet to fully close.5

The government is evaluating bids for its majority stake in SLT in an effort to improve foreign reserves, following a March 2023 cabinet decision.6 In January 2024, the Ministry of Finance prequalified two investors, Indian Jio Platforms and Chinese Gortune International Investment Holding, to submit bids. A third investor, Lyca Mobile, was not approved, and sued in February 2024 over claims that it had been arbitrarily and unfairly rejected.7 In April 2024, the Court of Appeals rejected the lawsuit, allowing bids for the majority stake in SLT to proceed.8

There are three main mobile service providers in Sri Lanka: Dialog Axiata, SLT-Mobitel, and Hutch. Dialog Axiata remains the country’s largest mobile service provider, with 17.2 million subscribers as of March 2024.9 SLT-Mobitel is a subsidiary of SLT and the second-largest mobile service provider, reporting 7.2 million subscribers in its 2023 annual report.10 Hutch reported 3.6 million active customer accounts in 2023.11 Airtel, another service provider in the country, had reported 3 million subscribers in 2023 before being acquired by Dialog Axiata.12

Dialog Axiata and Airtel agreed to combine operations in Sri Lanka in May 2023.13 Soon after, in June 2023, SLT-Mobitel challenged the merger, stating that the two companies’ combined market share and spectrum allocation would give it a monopolistic advantage.14 In January 2024, President Ranil Wickremesinghe summoned SLT chairman and chief executive Reyaz Mihular and called on SLT-Mobitel to withdraw its lawsuit against the TRCSL over the Dialog Axiata–Airtel merger (see A4). Mihular tendered his resignation shortly after the meeting, during which Wickremesinghe had suggested that the board be reconstituted.15 In April 2024, the TRCSL approved the merger,16 which was completed in late June 2024, after the coverage period.17

Under the Sri Lanka Telecommunications (Amendment) Act, No. 27 of 1996, the Ministry of Telecommunications issues licenses to internet service providers (ISPs), though the TRCSL can require providers to address any matter considered “requisite or expedient to achieving” its objectives.18 In May 2024, the parliament introduced a bill to amend the act, which would give the TRCSL expanded powers, including in approving and determining tariffs and granting and withdrawing licenses.19 In response, Media Law Forum, a CSO, filed a petition before the Supreme Court challenging the constitutionality of the amendments, stating that the bill’s provisions could lead to politically motivated decisions which favor certain operators.20 In June 2024, the court determined that certain provisions granting the TRCSL power over arbitrating anticompetitive practice allegations and radio frequency spectrum allocation unconstitutional.21 However, in July 2024, after the coverage period, once clarifying language was added to the relevant provisions,22 the parliament passed the bill.23

In October 2021, in an effort to compel mobile service providers to provide better service to retain customers, the TRCSL ordered providers to implement number portability, which would allow customers to change their service providers without changing their phone number.24 That initiative has faced continuous delays since the previous coverage period due to providers’ concerns about finding an appropriate technical partner.25

A5 1.00-4.00 pts0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 1.001 4.004

Score Change: The score improved from 0 to 1 to reflect better transparency and public consultation in some TRCSL decisions, though the regulator remains prone to politicized interference.

The national regulatory bodies overseeing service providers lack independence, and frequently do not act in a fair manner.

In November 2023, the cabinet approved the preparation of a draft broadcasting regulatory act which would establish the BRC.1 Under the proposed legislation, the presidentially appointed, five-member commission would oversee licensing for broadcasting services, including electronic media, and introduce an annual license renewal process. The proposed commission, tasked with ensuring “national security, national economy, and public order” in broadcasting, would also be empowered to seize the records of broadcasting services (see C6). The proposal has been strongly criticized by opposition parties and CSOs for its potential abuse by the BRC to punish and deny licenses to media companies that do not have a favorable view of the government.2

The TRCSL was established under the Telecommunications Act to protect the interests of the public and maintain effective competition between service providers (see A4). The TRCSL and related institutions have been under the control of the Ministry of Technology since Wickremesinghe restructured the ministry’s organization in October 2022.3

In July 2024, after the coverage period, the parliament passed amendments to the Telecommunications Act which grant the TRCSL expanded powers over licensing and tariffs. Opposition members like Sajith Premadasa have voiced concerns that the amendments might allow for “an increase in the opportunity for extortion,”4 given the TRCSL’s history of poor regulatory practices, instances of preferential treatment, government interference in decision-making, and a lack of transparency in recommending whether a telecommunications provider should receive a license.5

Presidential administrations have chosen political allies to head the TRCSL. The current chairman, Dharmasri Kumaratunge, serves as secretary to the Ministry of Technology,6 while the current director general of the TRCSL, Madhushanka Dissanayake, is also the senior assistant secretary to Wickremesinghe.7

B Limits on Content

B1 1.00-6.00 pts0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content, particularly material that is protected by international human rights standards? 4.004 6.006

The government does not systematically block or filter websites and other forms of online content, although a few independent websites and other sites are blocked, and authorities have briefly blocked social media platforms during previous coverage periods (see A3 and B8).

During the coverage period, the Open Observatory of Network Interference (OONI) reported signs of transmission control protocol and internet protocol (TCP/IP) blocking on several websites. For instance, news site Lankaenews appeared to have been impacted by domain name system (DNS) tampering on both Dialog Axiata and SLT connections during the coverage period,1 though it had previously been periodically accessible. The news site was reportedly blocked for publishing stories critical of then president Sirisena in 2017.2 Sankathi24, a Tamil news site, previously showed signs of being blocked from June 2020 to February 2023 on SLT connections. During the coverage period, the site showed signs of blocking on Dialog Axiata connections, including in May 2024.3

SLT’s unlimited data packages, which became available in April 2021, block torrents, peer-to-peer (P2P) applications, and the messaging app Telegram under their terms and conditions (see C4).

B2 1.00-4.00 pts0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content, particularly material that is protected by international human rights standards? 3.003 4.004

During the coverage period, the government issued takedown requests to news outlets and social media platforms, including under the newly enacted OSA (see B3 and C2). Individuals have also previously been summoned by authorities and ordered to make public apologies for content they posted online.

In April 2024, the Colombo Magistrate’s Court issued the first conditional order under the OSA when it ordered Gayatri Bimba to cease online communications about Janaka Ratnayake, the former chairman of the Public Utilities Commission of Sri Lanka.1 Ratnayake had filed a complaint under the OSA against Bimba, who had been his personal assistant, for allegedly harassing him by sharing private photos and videos of him over WhatsApp and discussing their intimate relationship in talk show interviews hosted on YouTube. Ratnayake also requested YouTube and WhatsApp to remove the content from their platforms under the act.2

In May 2024, the Colombo Magistrate’s Court issued a conditional order under the OSA against the YouTube channel Lanka UNews Official and its owner, Thushara Saliya Ranawaka, requiring the channel to cease publishing content about Lieutenant General Vikum Liyanage.3 The order came after Liyanage filed an action against Ranawaka, who lives outside Sri Lanka, for publishing allegedly defamatory content which accused Liyanage of war crimes and corruption, as well as against Google and YouTube for hosting the “insulting” content.4

In February 2024, after the Lankadeepa daily newspaper published an article about amendments to the OSA, SLPP lawmaker Jayantha Weerasinghe called for the Parliamentary Committee on Ethics and Privileges to investigate the report, which Weerasinghe asserted was false.5

Under Meta’s policy on dangerous individuals and groups, news content covering groups classified as dangerous can been moderated. Instagram has removed posts and has suspended the account of the Tamil Guardian news site, usually in relation to posts featuring Tamil nationalist protests and notable figures from the Liberation Tigers of Tamil Eelam (LTTE).6

B3 1.00-4.00 pts0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 1.001 4.004

Score Change: The score declined from 2 to 1 due to the passage of the widely criticized Online Safety Act, which empowers authorities to restrict access to online content and provides limited avenues for appeal.

There is a lack of transparency in the process for restricting online and digital content. Additionally, new laws that are ostensibly aimed at addressing cybercrimes lack independent appeals mechanisms.

The OSA, which criminalizes “false” and “harmful” online speech such as online harassment and abuse or content which would promote ill will and hostility, was passed in January 2024.1 The act establishes a five-person Online Safety Commission (OSC) that can compel ISPs and internet intermediaries, including search engines and social media platforms, to disable access to websites, chatrooms, or forums that host content the OSC deems to violate the OSA through a range of orders, including notices and directives. The president, with the approval of the Constitutional Council, appoints OSC members. The OSC can also issue recommendations to ISPs and internet intermediaries to remove allegedly violating content.

Social media platforms that do not comply with orders within the given time period can face fines of up to 10 million rupees ($30,300), and in some instances, sentences of up to seven years in prison. Meanwhile, if the owner of a website, chatroom, or forum fails to comply with conditional orders, they can face fines of up to 10 million rupees ($30,300), and in some instances, sentences of up to six years in prison. In October 2023, the Office of the UN High Commissioner for Human Rights criticized the bill, saying it would grant authorities “unfettered discretion to label and restrict expressions they disagree with as ‘false statements.’”2 In August 2024, after the end of the coverage period, amendments to the Online Safety Act were presented to parliament.3 Civil society organizations and tech companies have voiced concerns that the amendments—which tighten the scope of offenses under the act and repeal clauses criminalizing the communication of false statements against various government officials—will be insufficient in addressing the act’s potential for abuse.4

The Ministry of Mass Media (MMM) and Presidential Secretariat can order the TRCSL to instruct ISPs to block content for reasons including “publishing false information” and “damaging the president’s reputation.” While it is not clear if the TRCSL can impose financial or legal penalties on telecommunications companies that do not comply with blocking orders, changes to the Telecommunications Act (see C2) empower the TRCSL to issue guidelines to service providers and licensees, which could potentially include such penalties.5

Following April 2022 social media blocks (see A3 and B1), CSOs filed freedom of information requests with the TRCSL asking for related records6 and sent a fundamental rights petition to the Supreme Court.7 There are no records of ISPs challenging the TRCSL’s blocking orders at the commission itself or through the court.

Social media platforms have faced scrutiny for flawed content moderation in Sri Lanka. Facebook has received backlash for previously failing to distinguish between violence-instigating content and journalistic and cultural expression8 and failure to remove hateful Sinhala-language content that encouraged anti-Muslim violence in March 2018.9

B4 1.00-4.00 pts0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 2.002 4.004

Journalists proceed with caution when reporting on subjects that are considered sensitive. For instance, journalists have previously said they were hesitant to criticize then president Rajapaksa and his family or write on sensitive topics including rights violations, the army, corruption, missing people, and land appropriation.1 However, Sri Lankan internet users were vocal in their criticism of the government’s handling of the economic crisis in 2022 (see B8).2

Human rights organizations have expressed concerns that overbroad provisions criminalizing vaguely defined harmful online speech in the recently enacted OSA may be used to suppress online dissent and exacerbate a culture of self-censorship (see B3 and C2).3

Threats against journalists and social media activists (see C7) continue to raise concerns about escalating self-censorship. During this and the previous coverage period, individuals experienced direct retaliation for supporting the Aragalaya protest movement (see C3).

The government has a history of threatening public servants with disciplinary action for expressing ideas in alleged violation of the establishment code, which outlines the duties of government employees.4 In July 2023, the Ministry of Health issued a notice under the establishment code, banning its employees from speaking to the media on public-health issues after an uptick in death and illness— thought to be related to the quality of drugs used in state hospitals—was reported across the country.5

B5 1.00-4.00 pts0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 2.002 4.004

The spread of disinformation and misinformation has been a growing concern in recent years. Disinformation about candidates, electoral campaigns, and government decision-making spread on social media ahead of the planned, and later postponed, 2023 local elections.1 During the coverage period, disinformation targeting political parties and candidates spread on various social media platforms.2 During the 2022 Aragalaya protests, proxy accounts and Facebook pages associated with or supportive of the Rajapaksa family disseminated content that aimed to discredit the demonstrations.3

Ahead of the 2024 presidential elections, a 2023 analysis of misinformation trends by FactCrescendo, a fact-checking network, found that three political parties, the SLPP, National People’s Power (NPP), and the Samagi Jana Balawegaya (SJP), were frequent targets of misinformation campaigns.4 For instance, on X, a deepfake video circulated which appeared to show former US president Donald Trump endorsing NPP candidate Anura Kumara Dissanayake in May 2024.5

Ahead of the presidential elections, due to be held in September 2024,6 President Wickremesinghe is appointing a 10-person Commission of Inquiry to propose revisions to electoral laws,7 which would reportedly include the establishment of media guidelines for political parties and news organizations reporting on the election.8 As of the end of the coverage period, the draft media guidelines were not made public, though the Election Commission has solicited feedback on the guidelines from some CSOs.9

B6 1.00-3.00 pts0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 2.002 3.003

Some government regulations threaten the economic viability of online publishers and start-up platforms.1 Based on guidelines issued in 2019,2 websites were required to register with the MMM starting in 2020 to receive media accreditation, which websites need to cover certain events and engage in field reporting.3

In July 2021, news site MediaLK was reportedly denied accreditation; the MMM claimed that its founder, Tharindu Jayawardhana, had not received clearance from the Ministry of Defence, possibly in retaliation for the outlet’s reporting on senior police officials.4 In February 2023, the Human Rights Commission ruled that the MMM had violated MediaLK’s constitutional right to free expression by denying accreditation.5

In December 2023, the government approved a bill that would amend existing electoral law; the amendments allow the government to take legal action against media organizations and political candidates who violate “media guidelines.”6

The government has also maintained news site registration requirements introduced by previous administrations. During Mahinda Rajapaksa’s presidency, the MMM directed all news sites to register for a fee of 25,000 rupees ($75.69), with an annual renewal fee of 10,000 rupees ($30.27).

B7 1.00-4.00 pts0-4 pts
Does the online information landscape lack diversity and reliability? 3.003 4.004

Diverse content is generally available online in Sri Lanka, despite a history of censorship, intimidation targeting online journalists, and concerted efforts to spread misinformation about political events, like protests.1 Social media and communication platforms and blogs are popular and widely available, providing a platform for local debate. Sources of information in English, Sinhala, and Tamil are available online, including on socioeconomic and political issues.

Sri Lankans rely on several online outlets or companion websites that provide local and regional news and information. Sites such as Watchdog,2 Readme.lk,3 Groundviews, Vikalpa, Maatram,4 Manthri.lk,5 MediaLK,6 Himal Southasian,7 Counterpoint,8 and Anidda9 cover a range of political, social, and economic issues. Some media literacy initiatives examine the gaps between Sinhala- and Tamil-language newspapers in their reporting on gender, minority groups, transitional justice, and political reconciliation.10

Disinformation related to political events and national emergencies frequently spreads on social media platforms. In October 2023, various decades-old photos of priests and nuns carrying Palestinian flags circulated online, falsely represented as Palestinian Christians celebrating Hamas’s coordinated October 7 attack on Israel, likely intended to stoke conflict about the war.11

B8 1.00-6.00 pts0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 4.004 6.006

The internet has provided an avenue for robust digital activism and engagement on political issues in Sri Lanka. However, the OSA, passed in January 2024, penalizes a broad range of online speech, and experts have voiced concerns about its implications on online civic spaces and its potential use to deter political criticism (see B3, C2, and B4).1

Most online campaigns have typically been unable to gather the momentum needed to drive meaningful change and long-term citizen participation. However, in 2022, prompted by government mismanagement of an economic crisis, Sri Lankans mobilized online and in significant offline protests and actions which coalesced into the Aragalaya, a countrywide mobilization leading to the resignation of then President Gotabaya Rajapaksa. President Wickremesinghe, who was appointed president after Rajapaksa resigned, deployed a range of restrictions to suppress the ongoing protests, though Sri Lankans continued to mobilize online. Protesters received reprisals for posting footage from the protests and for posting in support of the Aragalaya.2

During this and the previous coverage period, protesters continued to mobilize online around the hashtag #GoHomeRanil in response to issues including Wickremesinghe’s crackdown on the protests, delayed local elections, and the economic crisis.3 Protesters have also used #EndtheOccupation, #FreePalestine, #SL4Palestine, and #ShutitDownforPalestine to amplify Sri Lankan and global protests calling for a cease-fire in Gaza.4

A May 2024 solidarity protest held to commemorate the end of Sri Lanka’s civil war in Colombo was marked by a heavy police presence, indicating that protesters’ online activity might have been surveilled.5

C Violations of User Rights

C1 1.00-6.00 pts0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 2.002 6.006

Although internet access is not guaranteed as a fundamental right in legislation, Article 14 (1)(a) of the constitution protects freedom of expression, subject to restrictions related to the protection of national security, public order, racial and religious harmony, and morality. There are no specific constitutional provisions guaranteeing freedom of expression online.

In July 2022, Wickremesinghe announced a state of emergency that granted sweeping powers of arrest and detention to the police and armed forces, lasting through August 2022.1 The regulations included clauses prohibiting the spread of rumors, false information, or information likely to cause public alarm, including online.2

In September 2023, the Ministry of Justice published the most recent version of draft Anti-Terrorism Act, intended to replace the contentious Prevention of Terrorism Act (PTA). Press freedom organizations, such as the Committee to Protect Journalists (CPJ), have raised concerns that both the draft bill and the PTA are “ripe for abuse against the media,” due to their broad definitions of terrorism, which “would allow authorities to continue cracking down on press freedom and freedom of expression.”3

Since the passage of the Right to Information Act in 2017,4 citizens have submitted thousands of applications on issues ranging from legislation on the rights of people with disabilities to the blocking of websites (see B3).5 Though in recent years, activists have raised concerns about whether right to information applications are an effective tool for citizens to request and access information from public authorities.6

C2 1.00-4.00 pts0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities, particularly those that are protected under international human rights standards? 1.001 4.004

Several vaguely defined, overly broad laws can be abused to prosecute users and restrict online expression.

In January 2024, the parliament passed the OSA, which criminalizes the publication of a range of broadly defined online speech, including content deemed as false, a threat to national security or public health, or which would promote feelings of ill will and hostility online. Individuals found to be in violation can face criminal penalties such as sentences of up to five years in prison and fines up to 500,000 rupees ($1,500). Additionally, individuals found guilty of online cheating or sharing false content with the intent to cause mutiny can face sentences of up to seven years in prison, fines of up to 700,000 rupees ($2,100), or both.1

In September 2023, the Ministry of Justice published the most recent version of the widely criticized draft Anti-Terrorism Act. The Anti-Terrorism Act is widely perceived to be a repackaging of the PTA, and has faced strong criticism from Sri Lankan civil society and international rights bodies2 for its broad definition of terrorist activity—it criminalizes speech that is “likely to be understood” as encouraging or inciting terrorism—and for placing broad restrictions on free expression, encroaching on data privacy, and targeting the use of encryption (see C4 and C6).3 In February 2024, the Supreme Court ruled that various provisions in the bill were inconsistent with the constitution, and that the bill could only be enacted with amendments to resolve those inconsistencies.4

Section 59 of the amended Telecommunications Act imposes penalties on a person who willfully makes a phone call or sends a message with the intention of disrupting public tranquility or causing public commotion. Violators could be fined as much as one million rupees ($3,000), imprisoned for up to three months, or both. Violators could receive a 1,500-rupee ($4.54) daily fine or a six-month prison sentence for continuous offenses. Any person who knowingly gives false information in relation to the commission of an offense may be subject to a 100,000-rupee ($302) fine or face a six-month prison term.5

Publishing official secrets, information about the parliament that may undermine its work, or “malicious” content that incites violence or disharmony can result in criminal charges.6 In January 2022, a senior police official claimed that law enforcement officers were legally able to arrest individuals who insult the president on social media.7

C3 1.00-6.00 pts0-6 pts
Are individuals penalized for online activities, particularly those that are protected under international human rights standards? 3.003 6.006

During the coverage period, internet users were prosecuted in retaliation for their online activities, including criticism of the government and participation in the Aragalaya protest movement.

Several people were arrested in relation to protests. In June 2023, social media activist Piyath Nikeshala was arrested for live-streaming protesters setting fire to the president’s private residence in July 2022 and was granted bail the next day.1 In January 2024, Nikeshala was arrested for publishing a phone conversation between Public Security Minister Tiran Alles and another activist on his YouTube channel. He was granted bail two days later.2

During the previous coverage period, various activists were arrested for social media posts showing support for the Aragalaya protests.3 In August 2022, British national Kayleigh Fraser’s passport was seized for an alleged visa violation after she posted footage of the protests on her Instagram account.4 She was later given a deportation order.5 In February 2024, the Supreme Court dismissed Fraser’s appeal to challenge her deportation.6

Authorities have summoned and questioned journalists and others working for online news outlets for other conduct related to their work (see C7). In October 2023, police questioned two Tamil freelance, online journalists, Punniyamoorthy Sasikaran and Valasingham Krishnakumar, about their reporting on a protest in the eastern city of Batticaloa (in which demonstrators objected to the government-backed settlement of ethnic Sinhalese in the area), and subsequently named them in a police investigation on related activities.7 In March 2024, the Criminal Investigation Department (CID) arrested GP Nissanka, editor of Ravana Lanka News, and kept him in custody for two weeks while investigating him for threats to national security after the outlet published a story about an army commander who had provided army cooks to a politician’s residence.8

Authorities also arrested users for offending religious sentiments. In April 2024, police arrested a man for distorting the lyrics of a traditional Buddhist song after he had posted a video of himself satirizing it on TikTok.9 In December 2023, a monk who goes by the name Sri Vishva Buddha was arrested for posting content found to be allegedly offensive to Buddhism on social media platforms.10 He was released on bail the next month.11 In October 2024, popular astrologer Indika Thotawatte was arrested and held in custody for two weeks for social media posts that were allegedly critical of Islam.12

Many young Tamils have also been detained over their social media posts, often for memorializing relatives who died during the civil war.13 In March 2024, the Terrorism Investigation Department (TID) summoned activist Selvanayagam Aravinthan for Facebook posts he made on Facebook found to be “supportive” of the LTTE. 14

There have been some positive developments in cases regarding online speech in recent years.

In September 2023, Mohammed Ramzy, a social media user who had been arrested six months earlier under the penal code, the International Covenant on Civil and Political Rights Act, and the Computer Crimes Act for posts he made on Facebook in April 2020, was exonerated. The Supreme Court held that his post, which denounced the discrimination of Muslims and called for an “an ideological jihad” in return, did not incite hostility or violence.15

In June 2024, after the end of the coverage period, blogger Bruno Divakara was acquitted of charges related to video footage he shared on his blog, SL-Vlogs, of a comedy set in which comedian Natasha Edirsooriya allegedly defamed Buddhism.16 The two were first arrested during the previous coverage period in May 2023.17

C4 1.00-4.00 pts0-4 pts
Does the government place restrictions on anonymous communication or encryption? 2.002 4.004

Users can freely use encryption tools, though there are some limits to anonymous digital communication and legislation proposed and passed during the coverage period have the potential to undermine encryption.

Under the recently enacted OSA, internet intermediaries who receive conditional orders from the OSC are required to either disclose the identity and location of the user who posted offending content or appear before the Magistrate’s Court; noncompliant intermediaries could face up to a fine of 10 million rupees ($30,300).1 Additionally, proposed amendments to the Anti-Terrorism Act (see C2) would similarly allow police officers to intercept, monitor and access data, including encrypted data, upon order from a magistrate.2

In September 2023, the parliament passed the Anti-Corruption Act, which empowers magistrates to, in the context of corruption investigations, direct any person providing encryption services to decrypt “the service or equipment and provide information contained therein.”3

Legal-name registration is required for mobile phone users under a 2008 Ministry of Defence program.4 In October 2020, the TRCSL required that all mobile phones be registered with them to stop refurbished mobile devices from flooding the market, announcing that SIM cards inserted in newly purchased unregistered phones would not be activated after a certain date.5 Access to public Wi-Fi hotspots requires a citizen’s national identity card number,6 which could be used to track online activity.

Service providers restrict or limit user access to security tools or certain applications. All but two SLT unlimited data plans blocked VPNs, torrents, peer-to-peer (P2P) applications, and Telegram as part of their terms and conditions as of March 2024.7 Dialog Axiata announced it would offer unlimited data plans that restrict the speed of torrenting services and Telegram.8

News sites are required to register under a procedure that requires owners, administrators, and editors to enter their personal details, including addresses, along with the domain name and internet protocol (IP) address of the website, with applications reviewed by a panel appointed by the secretary of the MMM.9 The form does not refer to a law or indicate the penalty for noncompliance.

The government is currently developing a biometric identification system with significant funding support from India. The new system will require six types of biometric data from citizens, including individuals’ eye color, fingerprints, and blood type, as well as personal identifying information. In November 2022, an official from the Ministry of Technology said citizens’ data would be added to Sri Lanka’s digital biometric identification system by 2024;10 however, as of the end of the coverage period, there have been no further updates on the project’s timeline.

C5 1.00-6.00 pts0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 2.002 6.006

State surveillance of online activities undermines users’ right to privacy, specifically activists and human rights defenders. The constitution does not recognize the right to privacy though the Personal Data Protection Act (PDPA) of 2022 contains the objective of ensuring it.1

The recently enacted OSA falls under the purview of the Ministry of Public Security, and CSOs have raised concerns about the potential use of the act by law enforcement, including the police, to surveil individuals’ online activity.2

Authorities have faced allegations of monitoring telephone conversations and social media platforms. In October 2021, an opposition parliamentarian alleged that the CID monitored his WhatsApp phone calls in 2018 and 2019 and called for an investigation into whether the CID had access to Pegasus or other spyware tools.3 In October 2022 the director of the CID was summoned before a parliamentary committee to discuss the allegations, but there were no public updates released after his testimony.4

State agencies may possess technologies that facilitate surveillance. In February 2023, Haaretz reported that the digital-services firm S2T had a Sri Lanka office and potentially Sri Lankan clients. S2T offers its clients tracking services, the ability to penetrate closed social media groups, and the means to remotely activate phone cameras and secretly create recordings.5 In March 2021, an anonymous Twitter user wrote that the Ministry of Defence had begun using Pegasus spyware with the cooperation of Dialog Axiata and SLT-Mobitel; an opposition parliamentarian also made this claim. Dialog Axiata and the media minister claimed the allegations were false.6

The CID and TID reportedly monitor the online space. In December 2023, it was announced that a separate unit had been set up within the CID to monitor insults to religion, including through social media, and allow the public to more efficiently report such offenses through a public hotline and email address.7 In recent years, various government officials have indicated that the CID, TID, and other agencies deploy teams to monitor online social content.8

Extrajudicial surveillance of personal communications is prohibited under the Telecommunications Act. However, communications can be intercepted on the order of a minister or a court, or in connection with a criminal investigation.

C6 1.00-6.00 pts0-6 pts
Does monitoring and collection of user data by service providers and other technology companies infringe on users’ right to privacy? 3.003 6.006

There are some legal requirements for telecommunications companies to aid the government in monitoring users, and companies have reportedly provided data to authorities.

Legislation proposed and passed during the coverage period gives the government greater power to access individuals’ personal data and has the potential to further undermine privacy. For instance, the newly enacted OSA (see B3 and C2) requires internet intermediaries to provide personal data about users who violate the act, including their emails, short-message service (SMS) history, social media activity, and instant messaging records.1

The proposed BRC (see A5) would empower authorities to enter and search the premises of broadcasting services, including electronic media, and seize and detain their records for investigations.2 Article 62 of the draft Anti-Terrorism Act (see C2) would require service providers to turn over user data to the authorities for investigations related to an overly broad definition of terrorism.3

In March 2022, the government passed the PDPA, which establishes a regulatory framework for personal data processed in Sri Lanka, as well as a Data Protection Authority (DPA), responsible for formulating the regulations and policy frameworks.4 The PDPA limits cross-border data transfers unless the DPA finds that the receiving country has an adequate standard of data protection.5 It also requires controllers or data processors to adopt instruments to ensure safeguards to the rights of data subjects.6 Section 26 of the PDPA requires government agencies and other public authorities to process personal data within Sri Lanka, with exceptions for certain categories of data.7

Data processors and controllers found processing data in contravention of the PDPA can face fines of up to 10 million rupees ($30,300) for each act of noncompliance, with a double penalty imposed for failing to conform to a directive.8 Civil society and journalists raised serious concerns about the bill the year it was ultimately passed, including about the independence of the DPA and about the lack of exceptions for journalists.9

The nature and number of government requests for data are unknown, since there is no legal provision that requires officials to notify targets. In 2016, however, SLT engineers apparently defied orders from their superiors to install equipment purchased for surveillance.10

C7 1.00-5.00 pts0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? 3.003 5.005

Journalists and activists, especially in the north and east, have frequently been the targets of assault, intimidation, and harassment in Sri Lanka, although it is not always directly related to their online activity.

In March 2024, Lal Perera, a YouTube journalist, was assaulted by police officers while attempting to record their use of tear gas and water cannon during a student protest.1 In February 2024, the army threatened to destroy the phones of three Tamil reporters—Prabhakaran Dilakshan, a reporter for online outlet Newscut; Sundarampillai Rajeskaran; and Chinnaiya Yogeswaran—while they were reporting on a temple gathering in Palali Vasavilan, after the army granted conditional access to a number of temples in Jaffna.2

In July 2023, YouTube journalist and activist Tharindu Uduwaragedara was asked for media accreditation by the police, beaten, and arrested while covering a union protest.3 Uduwaragedara was released on bail the next day.

In September 2023, two Tamil journalists were harassed by police while trying to interview medical students observing operations at the Kokkuthoduvai mass-grave excavation site.4

In May 2023, social media activist and protester Piyath Nikeshala was pulled out of his car and physically attacked by a group led by Chandika Abeyratne, a former deputy mayor and current member of the SLPP.5 Both Nikeshala and Abeyratne were subsequently hospitalized.

Police often use interrogations to intimidate internet users for their online activities. In May 2023, social media activist Darshana Handungoda was questioned by the CID for eight hours in connection with comments he made in a YouTube video about compensation for the XPress Pearl environmental disaster.6

Marginalized communities, such as women and members of the LGBT+ community, are frequent targets of online harassment and abuse. During the coverage period, several female activists, politicians, and celebrities were the targets of online misogyny.7 Election watchdogs have reported the use of artificial intelligence (AI) to perpetuate gender-based harassment.8

C8 1.00-3.00 pts0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 2.002 3.003

Government and business websites are vulnerable to hacking and other cyberattacks. Cyberattacks have also occasionally targeted government critics, civil society, and the media.1

In August 2023, 5,000 government email addresses within the gov.lk domain were targeted by a ransomware attack, resulting in all affected accounts losing three months’ worth of data going back to May 2023.2 In October 2023, news site Readme.lk reported that ride-hailing service PickMe suffered a data breach, exposing sensitive data of its customers; PickMe denied the breach occurred.3

Hacktivist groups targeted government websites during the 2022 protests, sometimes sharing messages of solidarity with the protesters. In April 2022, the presidential website was inaccessible, likely due to a distributed denial-of-service (DDoS) attack; an X account identified with the Anonymous India hacker group claimed responsibility.4

Media sites and journalists have also been targeted. In March 2024, state television network ITN’s YouTube channel was temporarily hacked, live-streaming content related to a cryptocurrency scam for over a day before the account was recovered.5

On Sri Lanka

See all data, scores & information on this country or territory.

See More

Country Facts

  • Population

    22,180,000

  • Global Freedom Score

    58 100 partly free

  • Internet Freedom Score

    53 100 partly free

  • Freedom in the World Status

    Partly Free

  • Networks Restricted

    No

  • Websites Blocked

    Yes

  • Pro-government Commentators

    Yes

  • Users Arrested

    Yes